drop rbi + email exports · correlate isolated url to phish message · runs locally
drop rbi + email exports · local only
heuristic screener · vendor schema varies · not definitive proof